lca[.]finance

The domain lca.finance has been identified as a credential theft scam, posing a significant threat to users. The domain does not appear to be associated with a specific brand or utilize a particular crypto drainer kit. However, it is actively used in phishing campaigns to steal sensitive information such as login credentials and personal data.

Analysis of the domain reveals the following technical indicators: VirusTotal scores 3/95 for this domain, with a low number of vendors detecting it, which may indicate a relatively new or sophisticated threat. The domain is registered through GNAME.COM PTE. LTD. and resolves to the IP address 185.111.111.156, located in Germany (DE) under the Autonomous System AS212238 Datacamp Limited. The domain was created on May 29, 2026, and is currently listed on three security blocklists: PhishDestroy, MetaMask, and SEAL. The SSL certificate is issued by Let's Encrypt with the serial number YE2, which is common for newly registered domains.

The domain lca.finance remains active, and despite being flagged by a minority of security vendors, the risk level is high due to its involvement in credential theft. Users are advised to avoid interacting with this domain and to implement additional security measures such as multi-factor authentication and regular password changes. Organizations should consider blocking this domain at the network level to prevent unauthorized access and data breaches. Security teams should monitor for any related infrastructure and take appropriate action to mitigate the threat.